On Nov 2, 2004, at 3:21 PM, Ari Leichtberg wrote:
On that note, does anybody know about the inner workings of flow-report?
My general understanding is that it loads up a huge hashtable (or other
data structure) in memory and then basically dumps out quick stats. Not
very cpu intensive. Is that accurate?
If there are less than 64K buckets in a key its a direct lookup otherwise a hash. So an IP protocol or IP port report would not use a hash, an IP address report would. If the pps and bps calculations are not in the report the floating point calculations are skipped which can really impact CPU cycles.
Flow-report can run many reports on one pass of the data depending on the memory available. This usually translates to a big speed gain when running many reports vs flow-stat due to the reduced disk I/O.
-- mark
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
